A Fully Updated 2023 CFR-410 Exam Dumps – PDF Questions and Testing Engine [Q45-Q69]

QUESTION 45
During which of the following attack phases might a request sent to port 1433 over a whole company network be seen within a log?

QUESTION 46
Which of the following are part of the hardening phase of the vulnerability assessment process? (Choose two.)

QUESTION 47
Senior management has stated that antivirus software must be installed on all employee workstations. Which of the following does this statement BEST describe?

QUESTION 48
After imaging a disk as part of an investigation, a forensics analyst wants to hash the image using a tool that supports piecewise hashing. Which of the following tools should the analyst use?

QUESTION 49
An incident handler is assigned to initiate an incident response for a complex network that has been affected by malware. Which of the following actions should be taken FIRST?

QUESTION 50
During a log review, an incident responder is attempting to process the proxy server’s log files but finds that they are too large to be opened by any file viewer. Which of the following is the MOST appropriate technique to open and analyze these log files?

QUESTION 51
A security engineer is setting up security information and event management (SIEM). Which of the following log sources should the engineer include that will contain indicators of a possible web server compromise? (Choose two.)

QUESTION 52
It was recently discovered that many of an organization’s servers were running unauthorized cryptocurrency mining software. Which of the following assets were being targeted in this attack? (Choose two.)

QUESTION 53
A user receives an email about an unfamiliar bank transaction, which includes a link. When clicked, the link redirects the user to a web page that looks exactly like their bank’s website and asks them to log in with their username and password. Which type of attack is this?

QUESTION 54
Various logs are collected for a data leakage case to make a forensic analysis. Which of the following are MOST important for log integrity? (Choose two.)

QUESTION 55
Which of the following, when exposed together, constitutes PII? (Choose two.)

QUESTION 56
A web server is under a denial of service (DoS) attack. The administrator reviews logs and creates an access control list (ACL) to stop the attack. Which of the following technologies could perform these steps automatically in the future?

QUESTION 57
Which of the following is a cybersecurity solution for insider threats to strengthen information protection?

QUESTION 58
A Linux administrator is trying to determine the character count on many log files. Which of the following command and flag combinations should the administrator use?

QUESTION 59
Which of the following is the GREATEST risk of having security information and event management (SIEM) collect computer names with older log entries?

QUESTION 60
Which of the following is susceptible to a cache poisoning attack?

QUESTION 61
During which phase of a vulnerability assessment would a security consultant need to document a requirement to retain a legacy device that is no longer supported and cannot be taken offline?

QUESTION 62
According to Payment Card Industry Data Security Standard (PCI DSS) compliance requirements, an organization must retain logs for what length of time?

QUESTION 63
While reviewing some audit logs, an analyst has identified consistent modifications to the sshd_config file for an organization’s server. The analyst would like to investigate and compare contents of the current file with archived versions of files that are saved weekly. Which of the following tools will be MOST effective during the investigation?

QUESTION 64
Which of the following data sources could provide indication of a system compromise involving the exfiltration of data to an unauthorized destination?

QUESTION 65
A first responder notices a file with a large amount of clipboard information stored in it. Which part of the MITRE ATT&CK matrix has the responder discovered?

QUESTION 66
When tracing an attack to the point of origin, which of the following items is critical data to map layer 2 switching?

QUESTION 67
An incident responder discovers that the CEO logged in from their New York City office and then logged in from a location in Beijing an hour later. The incident responder suspects that the CEO’s account has been compromised. Which of the following anomalies MOST likely contributed to the incident responder’s suspicion?

QUESTION 68
Which common source of vulnerability should be addressed to BEST mitigate against URL redirection attacks?

QUESTION 69
A common formula used to calculate risk is: + Threats + Vulnerabilities = Risk. Which of the following represents the missing factor in this formula?